Registrar's database said to have exposed data

A database problem with a major US domain registrar exposed sensitive financial and personnel information.

A database problem with a U.S. domain name registrar exposed sensitive financial and personal information relating to thousands of domain name registrations, a Dutch company said Friday.

DiscountDomainRegistry.com, of New York, fixed the problem shortly after being notified Thursday, said Nico Vandendries, chief executive officer of Strongwood, a private investigation company based in the Netherlands.

DiscountDomainRegistry.com Chief Executive Officer Alex Brecher said that the company is 100 percent positive customer data was not compromised. The "alleged vulnerability," he wrote, was patched within minutes after the company was contacted by Strongwood.

"We're in the midst of investigating these allegations, and we cannot provide detailed information at this time," Brecher wrote.

Erik Ekkelenkamp, a system project engineer with Strongwood, was researching .eu domain names when he clicked a link within DiscountDomainRegistry's site. The link led to an error involving execution rights on a MySQL directory. MySQL is a widely used open-source database program.

A script plus other programming usually unseen was visible that allowed for a connection to the database, which contained credit card numbers, usernames, passwords and other information, Vandendries said.

A DiscountDomainRegistry.com official wasn't initially convinced there was a problem, Vandendries said.

"At first, they didn't believe us until we presented him with his own password," Vandendries said. "And then he knew we were in."

On its Web site, DiscountDomainRegistry.com, founded in 1998, says it registers domain names for US$14.99 per year, including those of Fortune 500 companies.

So far, it's believed no one has exploited the error, which may have existed for up to four months, Ekkelenkamp said. DiscountDomainRegistry.com had changed parts of its Web site recently, which may have resulted in the bug, he said.

The damage could have been severe, Vandendries said. The credit card data and personal information from DiscountDomainRegistry.com clients could have been sold, he said.

Further, access to usernames and passwords would have allowed an intruder to change the names and IP (Internet Protocol) addresses associated with Web sites, a method used for so-called "phishing" scams, Vandendries said.

Phishing involves tricking users into visiting a Web site that appears legitimate but actually is a facade. The URL (uniform resource locator) may look authentic but connects to an IP address with a bogus Web site.

The fraudulent Web sites usually have forms for providing sensitive material, such as financial information, which is then directly sent to scammers.

Vandendries estimated it would take "little skill" with MySQL to exploit the bug. "If a bad guy found this leak and had access to the database ... then I'm sure it could have cost millions."

Ekkelenkamp said he received a call last night from the owner of DiscountDomainRegistry.com thanking him.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?